kubes_google 0.3.9 → 0.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d593aeda0613c869927cc4a394a6074f2cb0b37a65a300c34e2c1843795665fd
-  data.tar.gz: 612e010ffb671cbe6fae182be9013c0d0e0a35360ea74a3b241e31852ede785c
+  metadata.gz: cb741f591115d3b288978ec1f2c3a442d911bfd4553f0a606eb9c579c32e20bd
+  data.tar.gz: 48809f850b487a187ffe12188c9ea7fb2a9446bbdd798b5aaf5a4cc76bf3f784
 SHA512:
-  metadata.gz: '03709e5092eb0d4bdee232a60a3bd7369eff75e2b58591716fdc5a9e6d4833c5529740ee488e0a1cc2c04f389bb350e78bdbfd98c3d1b8d34717edd35025be90'
-  data.tar.gz: 492c3b693b2f44db71b08dabc1a66d1a45e3b776efab24292f438be1c94da5f9caf295c0da36e8c058f3f5b4d5cfff7c3f801135d1aaa164992bda2f7053368e
+  metadata.gz: 227d531538e94ce3a1746aa28b3fe9de339e45cf8450edc1171c304d4fc6f49e2041206fe70d0de8620a3a61d583ccb831114a114a50b9f20da15a668faabba7
+  data.tar.gz: b44bf02993394a774e6e45225650bd2e952c63080171df243a2fdd6adbedad1284350464a3ee2da1508fcb4fd4a56cf40c7f8b680dc68b0c1b9f94ee4e521162

data/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 This project *loosely tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.3.10] - 2022-08-19
+- [#11](https://github.com/boltops-tools/kubes_google/pull/11) Google service account fixes
+- KUBES_MOCK_SECRET ability
+- dont add project iam binding if already exists
+- fix iam service has_role? check
+
 ## [0.3.9] - 2022-02-16
 - [#10](https://github.com/boltops-tools/kubes_google/pull/10) google_secret_data helper
 

data/lib/kubes_google/secrets/fetcher.rb

@@ -10,8 +10,13 @@ class KubesGoogle::Secrets
     @@cache = {}
     def fetch(short_name)
       return @@cache[short_name] if @@cache[short_name]
-      logger.debug "Fetching secret: #{short_name}"
-      @@cache[short_name] = fetcher.fetch(short_name)
+      if ENV['KUBES_MOCK_SECRET']
+        logger.info "KUBES_MOCK_SECRET=1 is set. Mocking secret: #{short_name}"
+        @@cache[short_name] = "mock"
+      else
+        logger.debug "Fetching secret: #{short_name}"
+        @@cache[short_name] = fetcher.fetch(short_name)
+      end
     rescue KubesGoogle::VpnSslError
       logger.info "Retry fetching secret with the gcloud strategy"
       fetcher = Gcloud.new(@options)

data/lib/kubes_google/service_account.rb

@@ -34,14 +34,14 @@ module KubesGoogle
       logger.debug "Creating GKE IAM Binding"
       member = "serviceAccount:#{@google_project}.svc.id.goog[#{@namespace}/#{@ksa}]"
 
-      found = sh "gcloud iam service-accounts get-iam-policy #{@service_account} | grep -F #{member} > /dev/null"
+      found = sh "gcloud iam service-accounts get-iam-policy '#{@service_account}' | grep -F '#{member}' > /dev/null"
       return if found
 
       sh "gcloud iam service-accounts add-iam-policy-binding \
                 --role roles/iam.workloadIdentityUser \
-                --member #{member} \
+                --member '#{member}' \
                 --condition=None \
-                #{@service_account}".squish
+                '#{@service_account}'".squish
     end
 
     def add_roles
@@ -58,21 +58,28 @@ module KubesGoogle
     end
 
     def has_role?(role)
-      out = capture "gcloud projects get-iam-policy #{@google_project} --format json"
-      data = JSON.load(out)
+      data = project_iam_policies
       bindings = data['bindings']
       binding = bindings.find { |b| b['role'] == role }
       return false unless binding
-      binding['members'].include?(@service_account)
+      binding['members'].include?("serviceAccount:#{@service_account}")
+    end
+
+    @@project_iam_policies = nil
+    def project_iam_policies
+      return @@project_iam_policies if @@project_iam_policies
+      logger.debug "=> gcloud projects get-iam-policy #{@google_project} --format json"
+      out = capture "gcloud projects get-iam-policy #{@google_project} --format json"
+      @@project_iam_policies = JSON.load(out)
     end
 
     def add_role(role)
       return if has_role?(role)
 
       sh "gcloud projects add-iam-policy-binding #{@google_project} \
-          --member=serviceAccount:#{@service_account} \
+          --member='serviceAccount:#{@service_account}' \
           --condition=None \
-          --role=#{role} > /dev/null".squish
+          --role='#{role}' > /dev/null".squish
     end
   end
 end

data/lib/kubes_google/version.rb

@@ -1,3 +1,3 @@
 module KubesGoogle
-  VERSION = "0.3.9"
+  VERSION = "0.3.10"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubes_google
 version: !ruby/object:Gem::Version
-  version: 0.3.9
+  version: 0.3.10
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-02-16 00:00:00.000000000 Z
+date: 2022-08-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -160,7 +160,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.3.12
 signing_key: 
 specification_version: 4
 summary: Kubes Google Helpers Library